JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization
On the map: LLM safety and security → Jailbreaking
Abstract (arXiv)
Jailbreak attacks expose persistent safety weaknesses in large language models (LLMs), but existing stateless single-turn methods face a trade-off: hand-crafted prompts are expressive but static, while iterative prompt optimization can adapt but often relies on low-level mutations that require many target queries. We propose JailbreakOPT, a tool-assisted framework for improving iterative single-turn jailbreak prompt optimization. JailbreakOPT organizes diverse atomic jailbreak prompts into an attack tool library and composes them through a unified intra-episode optimization abstraction to generate stronger standalone attack prompts. To reuse experience across attack episodes, JailbreakOPT further frames tool selection as a contextual bandit problem and applies contextual Thompson sampling to guide exploration and exploitation based on past outcomes. Experiments across multiple target LLMs and attack goals show that JailbreakOPT improves attack success rate (ASR) while reducing the number of attacks until success (No.A) compared with atomic single-turn attacks and existing iterative optimization baselines. This paper may contain offensive or harmful content.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 35 of its 54 references that are in the map. First posted on arXiv 9 Jun 2026.
Builds on
35 of 54 references.
Closest ancestors · 18
Same direction, newest first
- 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety3 May
- 2025AutoDAN-Reasoning: Enhancing Strategies Exploration based Jailbreak Attacks with Test-Time Scaling6 Oct
- 2025Stand on The Shoulders of Giants: Building JailExpert from Previous Attack Experience25 Aug
- 2025MAJIC: Markovian Adaptive Jailbreaking via Iterative Composition of Diverse Innovative Strategies18 Aug
- 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey5 Jul
- 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Models31 May
- 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
- 2024CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models26 Feb
- 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks30 Jan
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
6 more
- 2023Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking16 Nov
- 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
- 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
- 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
- 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
Other references · 17
- 2025Qwen3 Technical Reportcited by 8,820
- 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2023A Comprehensive Survey of Continual Learning: Theory, Method and Applicationcited by 872
- 2017A Tutorial on Thompson Samplingcited by 433
- 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
- 2025Beyond Single-Turn: A Survey on Multi-Turn Interactions with Large Language Modelscited by 62
- 2024Against The Achilles' Heel: A Survey on Red Teaming for Generative Modelscited by 59
- 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 43
- 2019Conversational Contextual Bandit: Algorithm and Applicationcited by 35
- 2015A Survey on Contextual Multi-armed Banditscited by 34
- 2026Enhancing Financial Report Question-Answering: A Retrieval-Augmented Generation System with Reranking Analysiscited by 21
5 more
- 2025Attack and defense techniques in large language models: A survey and new perspectivescited by 14
- 2026Sustainable Hybrid Document-Routed Retrieval for Financial RAG: Resolving the Robustness-Precision Trade-offcited by 13
- 2018Adapting multi-armed bandits policies to contextual bandits scenarioscited by 8
- 2026Be Your Own Red Teamer: Safety Alignment via Self-Play and Reflective Experience Replaycited by 6
- 2026Improving the Completeness and Comparability of Segment Disclosures: A Large Language Model Approachcited by 6
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models
- 2024JailPO: A Novel Black-box Jailbreak Framework via Preference Optimization against Aligned LLMs
- 2026MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks
- 2026How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions
- 2026TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models
- 2025Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space
- 2026JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models
- 2025Online Learning Defense against Iterative Jailbreak Attacks via Prompt Optimization